←back to thread

Hack GPON – how to access, change and edit fibre ONTs

(hack-gpon.org)
250 points pabs3 | 5 comments | 25 Sep 24 00:41 UTC | HN request time: 0.82s | source
Show context
pabs3 ◴[25 Sep 24 03:48 UTC] No.41643508[source]▶
BTW: in the EU there is movement towards mandating ISPs allow BYOD, including fibre ONTs.

https://fsfe.org/activities/routers/

replies(5): >>41644411 #>>41644682 #>>41645903 #>>41645983 #>>41650536 #
the_mitsuhiko ◴[25 Sep 24 07:32 UTC] No.41644682[source]▶
I think it's vital that you can run your own modem but I'm not convinced that it's a good idea to force a custom ONT. An ONT is about as dumb as it gets and it's entirely transparent on the stack.

The benefit with an ONT (or even DOCSIS dumb modem) managed by the ISP is that they can do fleet upgrades much quicker as they don't have to keep all old protocols running. For instance the GPON -> XGSPON upgrade that some ISPs are running right now (or DOCSIS 3 upgrade) really only works well if you can turn off the old protocol which requires swapping out all ONTs/DOCSIS modems.

If customers bring their own stuff then you're stuck with these things for much longer.

replies(7): >>41644842 #>>41645271 #>>41646144 #>>41646849 #>>41648076 #>>41648114 #>>41659323 #
1. neelc ◴[25 Sep 24 14:43 UTC] No.41648114[source]▶
When I had CenturyLink, I replaced the ONT via a JTAG cable on the new ONT. The stock CL ONT (Calix 716GE-I R2) had a 16384 connection limit, which prevented me from running high-bandwidth Tor relays. The new ONT (Calix 803G) did not.

Calix for some reason makes it easy to clone some models.

I have a post on this: https://www.neelc.org/posts/clone-calix-ont/

Now I'm in NYC with Verizon Fios where I don't need a cloned ONT. Woo! The Verizon ONT is big and has a huge power brick, presumably because of RFoG alongside GPON.

replies(3): >>41648516 #>>41649081 #>>41649310 #
2. ImSorryButWho ◴[25 Sep 24 15:24 UTC] No.41648516[source]▶
That's very cool, but just to point out: that's not JTAG, it's serial (UART).

JTAG is a much lower level protocol, typically used for hardware or low-level software debugging. Serial/UART gives you a command-line interface to the software that's running.

Using a JTAG interface is a lot more complicated. If you're interested in playing with it, check out OpenOCD.

3. muppetman ◴[25 Sep 24 16:23 UTC] No.41649081[source]▶
How is the ONT, a Layer2/Ethernet device, involved in L3 sessions? Was it also the default gateway/router all rolled up into one?
replies(1): >>41649682 #
4. bauruine ◴[25 Sep 24 16:47 UTC] No.41649310[source]▶
Consumer routers are all extremely limited when it comes to many connections. Even an Ubiquiti UDM Pro only allows 65536 by default.
5. neelc ◴[25 Sep 24 17:22 UTC] No.41649682[source]▶
There is a mis-feature on the ONT called "Broadcom Packet Flow Cache". It apparently speeds up TCP sessions but at the expense of allowing a large amount of then.

Lumen fortunately moved off these ONTs. However, the new Smart NIDs have their fair share of issues from what I heard. I moved out of Lumen territory so have no experience with them.